On Thu, 1 Jun 2017, Loren Wilton wrote:
Hopeless-Forming-Philistinizes: jobs
Lossy-Cabdriver: 2368db81dcf1
Alba-Leanness-Elections: 38376DB11A
Merrimac-Grams-Participating: B354488539E
Giving-Remarkably-Incriminate: drawl
Dustin-Ransoming: 18
Person-Decathlon-Arnold: dfcfce7ba985
Majority-Gambles: 45555f856
Buttock-Milky-Dogged: 8E626A527D73
Scoff-Invoke: ea3ff6a6
Wish-Growing: 57878
Stiffest-Ghastly-Contaminates: 899
Cabling-Paddle: exploratory
Adjacency-Ranting: 89EC6563C14
Asinine-Midwife-Reread: 67b5d4b3973a75b
Note that these are all (so far) two or three word headers with initial
capson each word and all the rest lowercase, and a token value that is either
a single all-lower-case word or a single hex string. There are also no digits
to the left of the colon. Also, none of them start with "X-".
Just looking at the rather extensive headers on the mail I'm replying to,
exactly zero of them match the pattern I've described above.
...and that pattern is trivially easy for the spammer to change.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Journalism is about covering important stories.
With a pillow, until they stop moving. -- David Burge
-----------------------------------------------------------------------
5 days until the 73rd anniversary of D-Day
